Yarn

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorYarnpkg (29daa0c5-d32a-5084-8a2b-31bf906b3b1d)
ProductYarn (e8109904-d5aa-50a7-89d5-9e3049d38bbe)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/node-yarnpkg purl2cpe 2026-06-01 10:18:03.384353
pkg:deb/ubuntu/node-yarnpkg purl2cpe 2026-06-01 10:18:03.384357
pkg:github/yarnpkg/berry purl2cpe 2026-06-01 10:18:03.384359
pkg:github/yarnpkg/yarn purl2cpe 2026-06-01 10:18:03.384362
pkg:rpm/fedora/yarnpkg purl2cpe 2026-06-01 10:18:03.384365
pkg:rpm/opensuse/yarn purl2cpe 2026-06-01 10:18:03.384367
pkg:sourceforge/yarn.mirror purl2cpe 2026-06-01 10:18:03.384370

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-9308 vulnerable 2026-06-08 07:45:22.232922 yarnpkg Yarn request-manager.js setOptions redos
LOW (3.3)
A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2025-08-21T16:02:12.172Z
Updated: 2025-08-21T17:32:14.661Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-8262 vulnerable 2026-06-08 07:45:19.898227 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
MEDIUM (4.3)
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
Published: 2025-07-28T07:02:05.616Z
Updated: 2025-07-28T17:16:45.501Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-4435 vulnerable 2026-06-08 05:38:09.437107 Yarn: untrusted search path
HIGH (7.7)
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
Published: 2024-02-04T19:16:35.651Z
Updated: 2025-06-17T14:29:17.224Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-8131 vulnerable 2026-06-08 05:27:14.932846 Details available
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Published: 2020-02-24T14:41:23.000Z
Updated: 2024-08-04T09:48:25.635Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-5448 vulnerable 2026-06-08 05:13:59.173791 Details available
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Published: 2019-07-30T20:15:57.000Z
Updated: 2024-08-04T19:54:53.646Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-15608 vulnerable 2026-06-08 05:12:57.681931 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-10773 vulnerable 2026-06-08 05:12:25.268979 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.